First Malicious MCP Server Found in the Wild: Your AI Agent Has Been Secretly CC'ing Your Emails

A Normal-Looking Email With a Hidden Passenger

A developer configured their AI agent with an MCP (Model Context Protocol) server to handle email sending. The server looked completely legitimate — same name as the official version, worked flawlessly. The agent delivered every email to exactly the right recipient.

The problem was that extra copy no one asked for. While sending each email, the agent was also quietly CC'ing every single message to an unknown third party.

What makes this attack so insidious is that it doesn't reveal itself immediately. Security researchers have called it "the first malicious MCP server found in the wild" — and by the time it was exposed, it had already racked up over 1,600 downloads.

A Supply Chain Attack in a Single Line of Code

What makes this attack genuinely alarming is the method. The MCP server started out clean — fully functional, building user trust over time. Then, in one version update, the attacker added a single line of code. That one line caused every email the agent sent to be secretly copied and forwarded to a third party.

This is a textbook software supply chain attack, now playing out inside the AI tooling ecosystem. The attacker establishes trust with a harmless component that shares a name with an official package, waits for wide adoption, then slips in malicious logic through a routine update. For developers who have grown comfortable with automatic dependency updates, this kind of attack offers almost no natural tripwire.

Why MCP Is Especially Dangerous

At its core, an MCP server is code that runs with your agent's keys. Whatever permissions you've granted your agent — email access, the file system, API keys, database connections — the MCP server inherits all of it. It's not a sandboxed plugin. It operates under your identity, using your credentials.

That means a compromised MCP server can do far more than CC a few emails. It can quietly abuse any permission the agent holds, and the whole time, everything appears to be working normally.

MCP (Model Context Protocol) is an open protocol introduced by Anthropic in late 2024, designed to give AI agents a standardized way to connect to external tools and data sources. The concept was pitched as a kind of "USB-C for AI" — a unified interface through which different models and applications could invoke services like email, calendars, databases, and code execution environments. An MCP server is essentially a process that implements this protocol: the AI agent sends tool-call requests to it, the server executes them, and returns the results.

It's precisely this "execute on behalf of" architecture that creates the security exposure. MCP servers run using the host application's (i.e., the agent's) authentication credentials, not a separate, restricted account. This is fundamentally different from the security model of browser extensions or IDE plugins, which typically run in sandboxes with permissions explicitly constrained by the OS or platform. MCP currently has no mandatory permission declaration or runtime isolation mechanism. Once a third-party server is compromised, the blast radius is effectively equal to the full scope of whatever the agent itself has been authorized to do.

A software supply chain attack is one where the attacker doesn't breach the target system directly, but instead poisons an upstream component the target depends on. Some of the most well-known recent examples include the 2020 SolarWinds incident — where malicious code was injected into the official build pipeline of an IT monitoring product, affecting multiple U.S. government agencies — and the 2021 npm ecosystem poisoning of event-source-polyfill. These attacks succeed because developers place enormous trust in automated dependency management. Package managers like npm and pip pull the latest version by default, and in the developer's mental model, "latest version from the official publisher" is practically synonymous with "safe to use."

The AI tooling ecosystem is currently in a period of explosive, largely ungoverned growth. Publishing MCP servers involves almost no centralized review process, and anyone can publish a package with a name identical or nearly identical to an official one. This mirrors the early npm era of typosquatting attacks — but the consequences run deeper, because MCP servers don't just manipulate code logic. They control what an agent actually does in the real world.

How Developers Can Protect Themselves

This incident is a wake-up call for anyone running AI agents and MCP integrations in production. Based on what the disclosure revealed, here are several practical, actionable principles:

Verify Publisher Identity

Don't trust an MCP server based on name similarity alone. The attacker specifically exploited the "same name as the official package" trick to lower user suspicion. Confirming the publisher's real identity, repository source, and community reputation is the first gate before installation.

Pin the Version

This attack's core mechanism was an update. If you lock your dependency versions instead of blindly accepting the latest release, malicious code injected in a later version simply never reaches your environment. Version pinning is one of the most direct and effective defenses against supply chain poisoning.

Review Every Update

"Read every update" sounds tedious, but for tools with sensitive permissions, it's a necessary cost of doing business. A single line of code can cause a data breach, and update changelogs and code diffs will often expose anomalous changes before they cause damage.

Require Human Approval for High-Risk Operations

A more systematic approach is to track your agent's tool calls and introduce a human approval step for sensitive operations — sending emails, deleting files, calling external APIs. Tools like Agentify, mentioned in the original disclosure, are moving in exactly this direction: tracking every tool call the agent makes and inserting an approval gate before risky actions execute. This kind of "observability + approval" mechanism can intercept an attack before it causes real harm.

The Core Lesson: Your Agent Is Only as Secure as Its Weakest Tool

The sharpest takeaway from this incident is simple: your agent's security ceiling is defined by the security floor of the tools it uses.

As AI agents are granted more real-world permissions — sending and receiving email, managing accounts, accessing enterprise data — the tool chains they depend on become the new attack surface. Every playbook from traditional software supply chain attacks will resurface in the AI ecosystem, in more subtle forms and with more serious consequences.

For developers, the starting point for building trustworthy agent systems is treating MCP servers as code running under your own identity — not harmless little utilities. Verify the source, pin the version, review updates, require approvals for sensitive actions. These may feel like old-school security disciplines, but in the age of agents, they've never mattered more.